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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

Claim 1 (Previously Presented): A content scanning system for electronic documents 
such as emails comprising: 

a) a link analyser operative to identify hyperlinks in the content of electronic 
documents; 

b) a hyperlink replacer operative to modify the electronic documents by replacing 
hyperlinks to external objects identified by the link analyser by new hyperlinks to respective 
targets on a trusted server; and 

c) an object server operative on receipt of a request to retrieve an external object 
from one of said targets on the trusted server to cause a content scanner to scan the external 
object referenced by the hyperlink which was replaced by the new hyperlink to said one of said 
targets and to determine the acceptability of the object according to predefined rules, the object 
server being operative, responsive to a hyperlink being to an external object which is determined 
by the content scanner to be acceptable, to retrieve the external object and supply it in response 
to the request, the object server being operative, responsive to a hyperlink being to an external 
object which is determined by the content scanner to be unacceptable, to perform remedial 
action. 

Claim 2 (Previously Presented): A system according to claim 1 wherein the link 
analyser and the object server are operative to recursively process hyperlinks identified in 
external objects. 
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Claim 3 (Previously Presented): A system according to claim 2 in which only a 
maximum depth of recursion is permitted and the document is flagged as unacceptable if that 
limit is reached. 

Claim 4 (Previously Presented): A system according to claim 1 wherein the remedial 
action comprises one or more of: 

flagging or modifying the document to indicate that the content scanner has found the 
object to be unacceptable; 

modifying the document by replacing the hyperlink by a non-functional hyperlink; and 

quarantining the document and sending the intended recipient an alert advising the 
recipient that this has been done. 

Claim 5 (Currently Amended): A method of content- scanning electronic documents 
such as emails comprising: 

a) using a link analyser to identify hyperlinks in the content of electronic documents; 

b) modifying the electronic documents by replacing hyperlinks to external objects 
identified by the link analyser by new hyperlinks to respective targets on a trusted server; 

c) responsive to a request to retrieve an external object from one of said targets on 
the trusted server, using a content scanner to scan the external object referenced by the hyperlink 
which was replaced by the new hyperlink to one of said targets and to determine the acceptability 
of the object obj e cts according to predefined rules; 

d) responsive to a hyperlink being to an external object which is determined by the 
content scanner to be acceptable, retrieving the external object and supplying it in response to the 
request; and 

e) responsive to a hyperlink being to an external object which is determined by the 
content scanner to be unacceptable, performing remedial action. 

Claim 6 (Previously Presented): A method according to claim 5 wherein the steps a) 
through e) are used recursively to process hyperlinks identified in external objects. 
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Claim 7 (Original): A method according to claim 6 in which only a maximum depth of 
recursion is permitted and the document is flagged as unacceptable if that limit is reached. 

Claim 8 (Previously Presented): A method according to claim 5, wherein the 
remedial action comprises one or more of: 

flagging or modifying the document to indicate that the content scanner has found the 
object to be unacceptable; 

modifying the document by replacing the hyperlink by a non-functional hyperlink; and 

quarantining the document and sending the intended recipient an alert advising the 
recipient that this has been done. 

Claims 9-12 (Canceled). 

Claim 1 3 (Currently Amended): A system according to claim 1 , wherein the object 
server is operative, responsive to a hyperlink being to an external object e xt e rnal to th e docum e nt 
which object is determined by the content scanner to be acceptable, to retrieve the external 
object, to store it on the trusted server and to supply it in response to the request. 

Claim 14 (Previously Presented): A method according to claim 5, wherein the step of 
retrieving the external object and supplying it in response to the request, responsive to a 
hyperlink being to an external object which is determined by the content scanner to be 
acceptable, further comprises storing the retrieved object on the trusted scanner. 

Claim 1 5 (Previously Presented): A method of content-scanning electronic documents 
comprising: 

a) identifying first hyperlinks in contents of electronic documents; 

b) modifying the electronic documents by replacing the identified first hyperlinks 
with different second hyperlinks which point to a trusted server; 

c) storing data to relate the second hyperlinks to the first hyperlinks; 
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d) in response to a request received by the trusted server when one of the second 
hyperlinks is selected, using the stored data to determine the first hyperlink corresponding to the 
selected second hyperlink and retrieving an object using the determined first hyperlink; 

e) scanning the retrieved object in accordance with specified rules; 

f) making the retrieved object available in response to the received request if the 
retrieved object is determined to be acceptable in accordance with the specified rules; and 

g) performing remedial action if the retrieved object is not determined to be 
acceptable in accordance with the specified rules. 

Claim 16 (Currently Amended): The method according to claim 15, further 
comprising: 

generating the second hyperlinks based on one or more of a name of the trusted server, a 
time, a process identifier, a count that increments for each second hyperlink and a random 
number. 

Claim 1 7 (Previously Presented): An e-mail gateway comprising a trusted server 
configured to scan e-mail, the trusted server programmed to perform operations comprising: 

a) identifying first hyperlinks in contents of e-mails; 

b) modifying the e-mails by replacing the identified first hyperlinks with different 
second hyperlinks which point to a trusted server; 

c) storing data that relates the second hyperlinks to the first hyperlinks; 

d) in response to a request received by the trusted server when one of the second 
hyperlinks is selected, using the stored data to determine the first hyperlink corresponding to the 
selected second hyperlink and retrieving an object using the determined first hyperlink; 

e) scanning the retrieved object in accordance with specified rules; 

f) making the retrieved object available in response to the received request if the 
retrieved object is determined to be acceptable in accordance with the specified rules; and 

g) performing remedial action if the retrieved object is not determined to be 
acceptable in accordance with the specified rules. 
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Claim 1 8 (New): The e-mail gateway according to claim 1 7, wherein the trusted 
server is programmed to perform further operations comprising: 
identifying a third hyperlink in the retrieved object; 

modifying the retrieved object by replacing the identified third hyperlink with a different 
fourth hyperlink which points to the trusted server; and 

storing data that relates the fourth hyperlink to the third hyperlink. 

Claim 1 9 (New): The e-mail gateway according to claim 1 8, wherein the trusted 
server is programmed to perform further operations comprising: 

in response to a request received by the trusted server when the fourth hyperlink is 
selected, using the stored data to determine the third hyperlink corresponding to the selected 
fourth hyperlink and retrieving another object using the determined third hyperlink; 

scanning the retrieved other object in accordance with specified rules; 

making the retrieved other object available in response to the received request if the 
retrieved other object is determined to be acceptable in accordance with the specified rules; and 

performing remedial action if the retrieved other object is not determined to be acceptable 
in accordance with the specified rules. 
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